Log in Start free

coollabsio

Products

ProductCVEsExploitedLatest
Coolify76–Nov 3, 2026

Exploited and recent CVEs

  • CVE-2026-121587 Medium 5.3 Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints 0.3%
  • CVE-2026-100746 High 7.3 coollabsio Coolify GitHub App Setup redirect missing authentication 0.5%
  • CVE-2026-100744 High 7.3 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization 0.5%
  • CVE-2026-86117 High 8.1 Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching 0.7%
  • CVE-2026-84694 High 8.8 Coolify before 4.2.0 Remote Code Execution via Environment Variable Key 0.8%
  • CVE-2026-15507 Medium 6.3 coollabsio Coolify Policy Policies authorization 0.3%
  • CVE-2026-59734 High 8.8 Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution 0.8%
  • CVE-2026-42201 Low 3.3 Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands 0.2%
  • CVE-2026-34158 High 8.8 Coolify: Command injection via single-quote breakout in Docker Compose custom commands 0.4%
  • CVE-2026-34170 Medium 4.3 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL 0.2%
  • CVE-2026-34037 Critical 9.9 Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() 0.4%
  • CVE-2026-34048 Critical 9.9 Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers 0.8%
  • CVE-2026-34057 High 8.8 Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name 0.4%
  • CVE-2026-42143 High 8.8 Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers 0.5%
  • CVE-2026-42147 Medium 4.9 Coolify: SSRF via S3 Storage Endpoint in testConnection() 0.3%
  • CVE-2026-34044 High 7.7 Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) 0.4%
  • CVE-2026-34152 High 8.8 Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport) 0.7%
  • CVE-2026-34149 Low 3.3 Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs 0.3%
  • CVE-2026-34171 High 8.0 Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value 0.2%
  • CVE-2026-34034 High 8.8 Coolify: Host RCE via Sentinel token injection 0.8%
  • CVE-2026-34168 High 8.8 Coolify: Command injection via unsanitized persistent storage name in docker volume commands 0.5%
  • CVE-2026-42145 Low 3.1 Coolify: File Upload Without Type or Size Validation in Database Backup Restore 0.4%
  • CVE-2026-34198 Medium 5.3 Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing 0.2%
  • CVE-2026-34058 High 8.8 Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution 0.4%
  • CVE-2026-34035 High 8.8 Coolify: Host RCE via Log Drain secret/env command injection 0.4%
  • CVE-2026-34047 Critical 9.9 Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution 0.6%
  • CVE-2026-42172 Low 3.1 Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access 0.2%
  • CVE-2026-42200 High 8.8 Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE 0.7%
  • CVE-2026-42153 High 8.8 Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container 0.5%
  • CVE-2026-34167 Medium 5.0 Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor 0.3%